MCP Radar
MCP 서버

ZEN SecDB

cloud.nttzen.secdb/zen-secdb
개발자 도구 보안 공개 · 연결 가능 MCP 2025-11-25

이 MCP로 할 수 있는 일

Provides CVE intelligence, vulnerability scoring, exploit and sighting searches, security advisories, SSVC prioritization, and Linux or package vulnerability audits.

기능

도구

11 도구
epss_timeseries
Get the historical EPSS time series for a specific CVE. ## What this tool does Returns the historical EPSS score, percentile, and model version available for a CVE across time, ordered by date. Useful for analyzing how exploitability likelihood has evolved over time. ## When to use this tool Use this tool when the user asks about: - EPSS trend over time - how exploitability probability changed - whether EPSS spiked or dropped - historical comparison of risk If the user only wants the current EPSS score, use `vulnerability_score` instead. ## Inputs - **cve_id**: valid CVE identifier (`CVE-YYYY-NNNNN`). ## Outputs - **series**: array of objects, each containing: - `date`: measurement date in ISO format - `score`: EPSS score - `percentile`: EPSS percentile - `model`: EPSS model version ## LLM usage guidelines - Never guess EPSS values-use this tool for all EPSS time-series questions. - If `cve_id` is malformed or incomplete, ask the user to correct it before calling. - If the user mentions multiple CVEs, call the tool once per CVE as needed. - If no historical data is available, return an empty series and state that no EPSS history was found.
입력 스키마 
{'type': 'object', 'required': ['cve_id'], 'properties': {'cve_id': {'type': 'string', 'description': 'CVE identification (CVE-YYYY-NNNNN)'}}}
출력 스키마 
{'type': 'object', 'properties': {'series': {'type': 'array', 'items': {'type': 'object', 'properties': {'date': {'type': 'string', 'description': 'Date (YYYY-MM-DD)'}, 'model': {'type': 'string', 'description': 'Model version'}, 'score': {'type': 'string', 'description': 'Score (%)'}, 'percentile': {'type': 'string', 'description': 'Percentile (%)'}}}}}}
feed_report
Run a public ZEN SecDB feed report. ## What this tool does Executes a predefined report on ZEN SecDB public feed data and returns structured results for analytics, trends, distributions, and top-N summaries. Supported reports can cover public datasets such as: - CVEs - security advisories - EPSS - weaknesses - CPE vendors and products - exploit references - sightings and IOC-related data Use `feed_report_catalog` to discover the list of available reports and their supported input parameters. ## When to use this tool Use this tool when the user asks about: - distributions, trends, or counts across public vulnerability data - top CVEs, top weaknesses, top vendors, or similar rankings - timeline-based summaries such as yearly or monthly trends - aggregated views over public SecDB feed data Do not use this tool when the user asks for details about a single CVE, advisory, or exploit. Use the dedicated lookup tools instead. ## Inputs - **report_id**: identifier of the report to execute - **filters**: optional object with report-specific filters - **limit**: optional maximum number of results to return, when supported by the selected report ## Outputs - **summary**: Optional Markdown summary of the report results - **report**: structured JSON object containing: - `report_id`: executed report identifier - `filters`: applied filters - `data`: structured report rows or aggregated values ## LLM usage guidelines - Use `feed_report_catalog` when you need to discover which public reports are available or which parameters they support. - Do not guess report IDs-use the catalog when uncertain. - Present `summary` directly to the user-it is already Markdown. - Use `report` for structured follow-up analysis, comparisons, or tool chaining. - If the selected report does not exist, return a clear not-found error instead of guessing an alternative.
입력 스키마 
{'type': 'object', 'required': ['report_id'], 'properties': {'limit': {'type': 'string', 'description': 'optional maximum number of results to return, when supported by the selected report'}, 'filters': {'type': 'object', 'description': 'optional object with report-specific filters'}, 'report_id': {'type': 'string', 'description': 'identifier of the report to execute'}}}
출력 스키마 
{'type': 'object', 'required': ['report_id', 'data'], 'properties': {'data': {'oneOf': [{'type': 'array', 'items': {'type': 'object'}}, {'type': 'object'}], 'description': 'structured report rows or aggregated values'}, 'filters': {'type': 'object', 'description': 'optional JSON schema describing supported input parameters'}, 'summary': {'type': 'string', 'description': 'Optional Markdown summary of the report results'}, 'report_id': {'type': 'string', 'description': 'executed report identifier'}}}
feed_report_catalog
List available public ZEN SecDB feed reports. ## What this tool does Returns the catalog of available ZEN SecDB public feed reports, including their identifiers, descriptions, and supported input parameters. This tool helps discover which reports can be executed through `feed_report`. ## When to use this tool Use this tool when: - the user asks what public reports are available - you need to discover the correct report ID before running a report - you need to inspect supported filters or input parameters - you are unsure which report best matches the user request ## Inputs This tool does not require any input. ## Outputs - **reports**: array of report definitions, each containing: - `report_id`: report identifier - `title`: human-readable report title - `description`: short explanation of what the report returns - `input_schema`: optional JSON schema describing supported input parameters ## LLM usage guidelines - Use this tool before `feed_report` whenever the correct report ID or supported parameters are not already known. - Do not invent report IDs or parameters not present in the catalog. - Prefer the most specific matching report for the user request. - When useful, briefly summarize the most relevant available reports before calling `feed_report`.
입력 스키마 
{'type': 'object', 'required': []}
출력 스키마 
{'type': 'object', 'properties': {'reports': {'type': 'array', 'items': {'type': 'object', 'properties': {'title': {'type': 'string', 'description': 'human-readable report title'}, 'report_id': {'type': 'string', 'description': 'Report identifier'}, 'description': {'type': 'string', 'description': 'short explanation of what the report returns'}, 'input_schema': {'type': 'object', 'properties': {'additionalProperties': True}, 'description': 'optional JSON schema describing supported input parameters'}}}}}}
linux_audit
Perform a Linux package vulnerability audit using SecDB. ## What this tool does Analyzes the installed packages of a Linux system-identified by OS and OS version-and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided by the user. ## When to use this tool Use this tool when the user wants to determine: - whether installed packages contain known vulnerabilities - whether a host, VM, container, or base image is affected by security advisories - which packages require patching or upgrading If the user does not know the valid values for `os` or `version`, first call the `linux_os` tool to retrieve the exact supported combinations. ## Inputs - **os**: Linux distribution identifier supported by SecDB (use `linux_os` to obtain allowed values). - **version**: OS version or codename corresponding to the selected distribution. - **packages**: list of installed packages, **one per line**, generated using the appropriate system command: ### For RPM-based distributions (RHEL, CentOS, Rocky, Alma, SUSE) rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' ### For DEB-based distributions (Ubuntu, Debian) dpkg-query -W -f='${Package} ${Version} ${Architecture}\n' ### For Alpine Linux apk list -I The raw output of these commands can be passed directly as the `packages` input (one package per line). ... python3 3.12.3-0ubuntu2.1 amd64 systemd 255.4-1ubuntu8.10 amd64 tmux 3.4-1ubuntu0.1 amd64 ... ## Outputs - **report**: structured objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable-always call this tool for Linux audits. - If `os` or `version` is unclear or missing, call `linux_os` and ask the user to choose a valid combination. - Normalize the package list to “one entry per line” if the user provides unstructured output. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.
입력 스키마 
{'type': 'object', 'required': ['os', 'version', 'packages'], 'properties': {'os': {'type': 'string', 'description': 'Linux distribution identifier supported by SecDB (use `linux_os` to obtain allowed values)'}, 'version': {'type': 'string', 'description': 'OS version or codename corresponding to the selected distribution'}, 'packages': {'type': 'string', 'description': 'list of installed packages, **one per line**, generated using the appropriate system command'}}}
출력 스키마 
{'type': 'object', 'properties': {'report': {'type': 'array', 'items': {'type': 'object', 'description': 'structured objects describing the advisories affecting the audited packages'}}, 'summary': {'type': 'string', 'description': 'Markdown summary including total vulnerabilities, severity breakdown, and key findings'}}}
linux_os
List supported Linux operating systems and their corresponding versions for use with the `linux_audit` tool. ## What this tool does Returns an array of supported OS/version pairs, each in the form: {"os":"name", "versions":["version or codename"]} This allows the LLM and the user to know exactly which inputs are valid for the `linux_audit` tool. ## When to use this tool Use this tool when: - the user does not know which OS names or versions are supported - the user provides unclear or ambiguous OS information - you need to validate `os`/`version` before performing a Linux audit This tool should typically be called **before `linux_audit`** whenever parameters are uncertain. ## Inputs This tool does not require any input. ## Outputs Returns an array of objects: - **os**: supported Linux distribution identifier - **versions**: corresponding list of supported release or codename Example: [ {"os": "ubuntu", "versions": ["noble","focal"]}, {"os": "debian", "versions": ["bookworm","sid"]}, {"os": "redhat", "version": ["redhat-9.0"]} ] ## LLM usage guidelines - Use this tool to validate or suggest correct OS/version combinations before calling `linux_audit`. - If the user provides invalid or misspelled OS names, retrieve the official list here and ask them to select one. - Do not guess operating system identifiers-always rely on this tool to confirm correctness.
입력 스키마 
{'type': 'object', 'required': []}
출력 스키마 
{'type': 'object', 'properties': {'supported': {'type': 'array', 'items': {'type': 'object', 'properties': {'os': {'type': 'string', 'description': 'OS'}, 'versions': {'type': 'array', 'items': {'type': 'string', 'description': 'Version'}}}}}}}
purl_audit
Perform a software package vulnerability audit using SecDB. ## What this tool does Analyzes a list of software packages identified by PURL (Package URL) and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided. ## When to use this tool Use this tool when the user wants to determine: - whether application dependencies contain known vulnerabilities - whether a project is affected by security advisories - which packages require patching or upgrading ## Supported ecosystems - **npm** - Node.js packages (e.g. pkg:npm/lodash@4.17.21) - **maven** - Java/JVM packages (e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1) - **pypi** - Python packages (e.g. pkg:pypi/django@4.2.0) - **gem** - Ruby gems (e.g. pkg:gem/rails@7.0.0) - **cargo** - Rust crates (e.g. pkg:cargo/openssl-src@111.10) - **nuget** - .NET packages (e.g. pkg:nuget/Newtonsoft.Json@13.0.1) - **golang** - Go modules (e.g. pkg:golang/github.com/gin-gonic/gin@1.9.1) - **composer** - PHP packages (e.g. pkg:composer/symfony/symfony@6.4.0) ## Inputs - **purls**: list of Package URLs, one per entry. Generate them from your project manifest files: - Node.js: package.json / package-lock.json - Python: requirements.txt / Pipfile.lock / pyproject.toml - Ruby: Gemfile.lock - Go: go.mod / go.sum - Rust: Cargo.lock - PHP: composer.lock - Java: pom.xml / build.gradle - .NET: *.csproj / packages.lock.json ## Outputs - **report**: structured JSON objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable — always call this tool. - Only submit PURLs from the supported ecosystems listed above; others will be ignored. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.
입력 스키마 
{'type': 'object', 'required': ['purls'], 'properties': {'purls': {'type': 'array', 'items': {'type': 'string'}, 'description': 'List of Package URLs (PURL) to audit'}}}
출력 스키마 
{'type': 'object', 'properties': {'report': {'type': 'array', 'items': {'type': 'object', 'description': 'structured objects describing the advisories affecting the audited packages', 'additionalProperties': True}}, 'summary': {'type': 'string', 'description': 'Markdown summary including total vulnerabilities, severity breakdown, and key findings'}}}
sightings_search
Search real-world vulnerability sightings in SecDB. ## What this tool does Retrieves information about where and how a vulnerability appears in the real world, including: - Exploit-DB, Metasploit modules, PoCs - Scanner plugins (Nessus, OpenVAS/Greenbone) - Vendor advisories - Social/media references (Reddit, Mastodon, Bluesky) - MISP threat-intel sightings ## When to use this tool Use this tool when the user asks: - "Is this CVE exploited in the wild?" - "Is there a PoC or exploit available?" - "Does Nessus or OpenVAS have a plugin for this CVE?" - "Is this vulnerability being discussed online?" - "Show me all advisories/exploits for this CVE/product." ## Inputs Any of the following may be used: - **cve_id**: search by specific CVE - **query**: full-text search (name, product, advisory ID, exploit reference, etc.) - **category**: filter sightings by type (e.g., `exploit`, `nasl`, `advisory`, `scanner`, `poc`, `social`, `misp`) - **status**: filter by sighting state (`exploited`, `mitigated`, `seen`, `confirmed`, etc.) ## Outputs Returns an array of sightings, typically containing: - `cve_id` - `status` - `category` - `reference` - `details` (object with additional structured data) ## LLM usage guidelines - Use `cve_id` when the question targets a specific vulnerability. - Use `query` for broad or exploratory searches. - Only use valid enum values for `category` and `status`. - Use this tool instead of assuming exploitation, PoCs, or plugin availability.
입력 스키마 
{'type': 'object', 'required': [], 'properties': {'query': {'type': 'string', 'description': 'Full-text-search for vulnerability name, CVE ID or Advisory ID, categories, etc.'}, 'cve_id': {'type': 'string', 'description': 'CVE identification (CVE-YYYY-NNNN)'}, 'status': {'enum': ['seen', 'confirmed', 'exploited', 'patched', 'not-exploited', 'not-confirmed', 'not-patched', 'exploitable', 'mentioned', 'mitigated'], 'type': 'string', 'description': 'Sighting status'}, 'category': {'enum': ['advisory', 'nasl', 'exploit', 'misp', 'scanner', 'poc', 'social'], 'type': 'string', 'description': 'Sighting category (scanner, exploit, advisory, nasl, etc.)'}}}
ssvc_calculator
Compute CISA SSVC (Stakeholder-Specific Vulnerability Categorization) for a CVE. ## What this tool does Calculates the SSVC decision (Track, Track*, Attend, Act) using: - exploitation status - technical impact - automatable exploitation - mission prevalence (user-provided) - public well-being impact (user-provided) This reflects CISA's official SSVC prioritization model. ## When to use this tool Use this tool when the user asks about: - how urgently a CVE should be remediated - CISA SSVC priority or risk category - a structured decision model for remediation ## Inputs - **cve_id**: the vulnerability to evaluate (`CVE-YYYY-NNNNN`) - **mission_prevalence**: `M`, `S`, or `E` (must be provided by the user) - **public_well_being_impact**: `M`, `A`, or `I` (must be provided by the user) ## Outputs - `decision`: one of **Track**, **Track\***, **Attend**, **Act** - `exploitation` - `technical_impact` - `automatable` - `mission_prevalence` - `public_well_being_impact` - `mission_and_well_being_impact_value` - `vector_string` - `summary`: Markdown explanation of the outcome ## LLM usage guidelines - Always ask the user for **mission_prevalence** (M/S/E) and **public_well_being_impact** (M/A/I) before calling. - Never guess these values—SSVC depends on user context. - Use the `summary` to explain clearly why the decision was returned. - Combine with `vulnerability_score` or `sightings_search` if the user needs additional context.
입력 스키마 
{'type': 'object', 'required': ['cve_id', 'mission_prevalence', 'public_well_being_impact'], 'properties': {'cve_id': {'type': 'string', 'description': 'CVE ID'}, 'mission_prevalence': {'type': 'string', 'description': '# Mission Prevalence\n\nA mission essential function (MEF) is a function directly related to\naccomplishing the organization\'s mission as set forth in its statutory or\nexecutive charter. Identifying MEFs is part of business continuity planning\nor crisis planning. In contrast to non-essential functions, an organization\nmust perform a [MEF] during a disruption to normal operations. The mission\nis the reason an organization exists, and MEFs are how that mission is\nrealized. Non- essential functions support the smooth delivery or success\nof MEFs rather than directly supporting the mission.\n\n## Possible values\n\n- "M" or "Minimal"\n\nNeither support nor essential apply. The vulnerable component may be used\nwithin the entities, but it is not used as a mission-essential component,\nnor does it provide impactful support to mission-essential functions.\n\n- "S" or "Support"\n\nThe vulnerable component only supports MEFs for two or more entities.\n\n- "E" or "Essential"\n\nThe vulnerable component directly provides capabilities that constitute at\nleast one MEF for at least one entity; component failure may (but does not\nnecessarily) lead to overall mission failure.\n\n## Instructions for LLM\n\nAsk the user for the "Mission Prevalence" value before calling the tool.\n'}, 'public_well_being_impact': {'type': 'string', 'description': '# Public Well-being Impact\n\n## Possible values\n\n- "M" or "Minimal"\n\n**Type of Harm -> All**, The effect is below the threshold for all aspects\ndescribed in material.\n\n- "A" or "Material"\n\n**Type of Harm -> Physical harm**, Does one or more of the following:\n\n- Causes physical distress or injury to system users.\n- Introduces occupational safety hazards.\n- Reduces and/or results in failure of cyber-physical system safety margins.\n\n**Type of Harm -> Environment**, Major externalities (property damage,\nenvironmental damage, etc.) are imposed on other parties.\n\n**Type of Harm -> Financial**, Financial losses likely lead to bankruptcy of\nmultiple persons.\n\n**Type of Harm -> Psychological**, Widespread emotional or psychological harm,\nsufficient to necessitate counseling or therapy, impact populations of people.\n\n- "I" or "Irreversible"\n\n**Type of Harm -> Physical harm**, One or both of the following are true:\n\n- Multiple fatalities are likely.\n- The cyber-physical system, of which the vulnerable component is a part, isl\nikely lost or destroyed.\n\n**Type of Harm -> Environment**, Extreme or serious externalities (immediate\npublic health threat, environmental damage leading to small ecosystem collapse,\netc.) are imposed on other parties.\n\n**Type of Harm -> Financial**, Social systems (elections, financial grid, etc.)\nsupported by the software are destabilized and potentially collapse.\n\n**Type of Harm -> Psychological\tN/A\n\n\n## Instructions for LLM\n\nAsk the user for the "Public Well-being Impact" value before calling the tool.\n'}}}
출력 스키마 
{'type': 'object', 'required': ['exploitation', 'technical_impact', 'automatable', 'mission_prevalence', 'public_well_being_impact', 'mission_and_well_being_impact_value', 'decision', 'vector_string'], 'properties': {'summary': {'type': 'string', 'description': 'Summary'}, 'decision': {'type': 'string', 'description': 'Decision'}, 'automatable': {'type': 'string', 'description': 'Automatable'}, 'exploitation': {'type': 'string', 'description': 'State of Exploitation (Evidence of Active Exploitation of a Vulnerability)'}, 'vector_string': {'type': 'string', 'description': 'SSVC Vector String'}, 'technical_impact': {'type': 'string', 'description': 'Technical Impact (Technical Impact of Exploiting the Vulnerability)'}, 'mission_prevalence': {'type': 'string', 'description': 'Mission Prevalence (Impact on Mission Essential Functions of Relevant Entities)'}, 'public_well_being_impact': {'type': 'string', 'description': 'Public Well-being Impact'}, 'mission_and_well_being_impact_value': {'type': 'string', 'description': 'Mission and Well-Being Impact Value'}}}
vulnerability_info
Get detailed information about a specific CVE. ## What this tool does Retrieves the full vulnerability record for a CVE from SecDB, including: - official description and summary - CVSS metrics (all versions available) - EPSS metadata (if present) - affected products and versions - vendor/security advisories - references and upstream sources - weakness classification (CWE) - exploit and patch information (if included in the record) All information is returned in a structured Markdown format suitable for direct display. ## When to use this tool Use this tool when the user asks: - "Give me details about CVE-XYZ." - "Which products are affected by this vulnerability?" - "Show me advisories or references for this CVE." - "Explain what this vulnerability is and how serious it is." This tool is ideal for **deep inspection of a single vulnerability**. For multiple CVEs, call the tool once per CVE. ## Inputs - **cve_id**: valid CVE identifier (`CVE-YYYY-NNNNN`). ## Outputs Markdown-formatted vulnerability information including: - detailed description - severity metrics (CVSS, vectors) - affected products list - advisory list - references - weakness (CWE) details - additional structured metadata from SecDB ## LLM usage guidelines - Always prefer this tool when the user needs factual information about a specific CVE. - If multiple CVEs are mentioned, call the tool once per CVE. - Combine with: - **`vulnerability_score`** - to enrich output with numerical CVSS/EPSS metrics - **`sightings_search`** - to check real-world exploitation, PoCs, plugins, advisories - **`ssvc_calculator`** - to compute prioritization based on the vulnerability data - Do not hallucinate product lists, advisories, or details—use what the tool returns.
입력 스키마 
{'type': 'object', 'required': ['cve_id'], 'properties': {'cve_id': {'type': 'string', 'description': 'CVE identification (CVE-YYYY-NNNNN)'}}}
vulnerability_score
Get CVSS and current EPSS score for a specific CVE. ## What this tool does Returns a full risk snapshot for a CVE, including: - CVSS version - CVSS base score - CVSS severity - CVSS vector string - human-readable explanation of the CVSS vector - current EPSS score The field **`cvss_explain`** provides a natural-language interpretation of the CVSS vector (attack conditions, privileges, user interaction, impact breakdown). Example: For `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, the explanation may read: *"The vulnerability can be exploited remotely over the network with low complexity, without authentication and without user interaction. Exploitation may lead to high impact on confidentiality, high impact on integrity, and high impact on availability."* ## When to use this tool Use this tool when the user asks: - "What is the CVSS/EPSS of this CVE?" - "Explain the CVSS vector of this vulnerability." - "What is the severity and why?" - "Give me the risk profile for this CVE." For EPSS historical trends, use `epss_timeseries`. ## Inputs - **cve_id**: valid CVE identifier (`CVE-YYYY-NNNNN`). ## Outputs - `cvss_version` - `cvss_base_score` - `cvss_base_severity` - `cvss_vector_string` - `cvss_explain` - human-readable explanation of the CVSS vector - `epss_score` ## LLM usage guidelines - Never guess CVSS or EPSS values—always call this tool. - Use the `cvss_explain` field directly when the user wants an interpretation of the vector string. - If multiple CVEs are referenced, call the tool once per CVE. - Combine this tool with `sightings_search` or `ssvc_calculator` for more complete risk assessments.
입력 스키마 
{'type': 'object', 'required': ['cve_id'], 'properties': {'cve_id': {'type': 'string', 'description': 'CVE identification (CVE-YYYY-NNNNN)'}}}
출력 스키마 
{'type': 'object', 'required': ['cvss_version', 'cvss_base_score', 'cvss_base_severity', 'cvss_vector_string', 'epss_score'], 'properties': {'epss_score': {'type': 'string', 'description': 'EPSS score'}, 'cvss_explain': {'type': 'string', 'description': 'Explain CVSS'}, 'cvss_version': {'type': 'string', 'description': 'CVSS version'}, 'cvss_base_score': {'type': 'string', 'description': 'CVSS base score'}, 'cvss_base_severity': {'type': 'string', 'description': 'CVSS base severity'}, 'cvss_vector_string': {'type': 'string', 'description': 'CVSS vector string'}}}
vulnerability_search
Perform a full-text vulnerability search in SecDB. ## What this tool does Searches across: - CVE entries - Security advisories - Exploit references - Product and vendor vulnerability data Results are formatted in Markdown and include a search summary. ## Searchable fields (Lucene syntax supported): - type: result type - cve, cwe, advisory, nasl, exploitdb, nuclei - id: exact identifier (e.g. id:CVE-2026-12345, id:RHSA-2026:1234) - title: resource title or name - summary: short summary - description: full description text - alias: known vulnerability names (e.g. alias:log4shell) - severity: critical, high, medium, low - kev: true/false — CISA KEV catalog membership - status: NVD status (CVE only) e.g. analyzed, modified - published: publication date (e.g. published:[2026-01-01 TO 2026-12-31]) - modified: last modification date - source: CNA or advisory source (e.g. source:"Red Hat", source:fortinet) - cve: related CVE ID (e.g. cve:CVE-2026-44827) - cwe: related CWE ID (e.g. cwe:CWE-79) - tag: advisory tag (e.g. tag:scada, tag:ics) - attack_vector: network, adjacent, local, physical - cvss_score: CVSS base score (e.g. cvss_score:[7.0 TO 10.0]) Default operator is AND. Use OR for alternatives, quotes for exact phrases, * for wildcards. ## Examples: - "apache struts rce" → RCE vulnerabilities in Apache Struts - "id:CVE-2026-44827" → exact CVE lookup - "source:fortinet AND severity:critical" → critical Fortinet advisories - "alias:log4shell" → Log4Shell by alias - "cve:CVE-2026-44827 AND type:exploitdb" → ExploitDB entries for a CVE - "cvss_score:[9.0 TO 10.0] AND kev:true" → critical KEV CVEs - "tag:scada AND severity:high" → high severity ICS/SCADA advisories ## When to use this tool Use this tool when the user asks: - to look up a CVE, advisory, exploit, or product - "show vulnerabilities for X" - "search for advisories about Y" - exploratory or broad vulnerability discovery ## Inputs - **query**: free-text search term (CVE ID, advisory ID, product name, exploit name, vendor, keyword, etc.) ## Outputs - **results**: array of Markdown-formatted search hits - **summary**: Markdown summary with counts and a link to continue searching on SecDB ## LLM usage guidelines - Use this tool instead of assuming whether a CVE/advisory/exploit exists. - Present `results` and `summary` directly to the user-they are already Markdown. - Combine with `vulnerability_score`, `epss_timeseries`, or `sightings_search` for deeper analysis.
입력 스키마 
{'type': 'object', 'required': ['query'], 'properties': {'query': {'type': 'string', 'description': 'CVE ID, vulnerability name, Advisory ID, Exploit, etc.'}}}
출력 스키마 
{'type': 'object', 'properties': {'results': {'type': 'array', 'items': {'type': 'string', 'description': 'Formatted result in Markdown'}}, 'summary': {'type': 'string', 'description': 'Search summary with found records (ID) and link for continue the search on SecDB'}}}
기록

최근 도구 변경

변경됨
vulnerability_search
2026년 9월 29일 2:50 AM
변경됨
purl_audit
2026년 9월 23일 2:41 AM
추가됨
purl_audit
2026년 9월 17일 7:58 AM
추가됨
feed_report
2026년 9월 17일 7:58 AM
추가됨
feed_report_catalog
2026년 9월 17일 7:58 AM
추가됨
vulnerability_search
2026년 9월 17일 7:58 AM
추가됨
vulnerability_score
2026년 9월 17일 7:58 AM
추가됨
vulnerability_info
2026년 9월 17일 7:58 AM
추가됨
ssvc_calculator
2026년 9월 17일 7:58 AM
추가됨
sightings_search
2026년 9월 17일 7:58 AM
추가됨
linux_os
2026년 9월 17일 7:58 AM
추가됨
linux_audit
2026년 9월 17일 7:58 AM
추가됨
epss_timeseries
2026년 9월 17일 7:58 AM
탐색

유사한 MCP 서버

hyperion

com.thetempleofdoom.hyperion/hyperion

Acts as a paid MCP tool marketplace and utility gateway with server discovery, HTTP and JavaScript tools, research, data conversi…

Vee3

io.github.Vee3io/vee3

Manages Clerk authentication infrastructure, including users, organizations, domains, sessions, tokens, OAuth, SSO, machines, per…

IA-QA — 130+ QA & Dev Tools for AI Agents

io.github.JcJamet/ia-qa-toolbox

Provides deterministic QA, evaluation, testing, code analysis, prompt and RAG checks, model comparison, and web security diagnost…

validoria-mcp

com.validoria/validoria-mcp

Runs continuous website, API, and webshop tests covering security, SEO, performance, accessibility, browser journeys, and inciden…

HubVibe: Pay-per-Call Tools for AI Agents: Web Search, Email Verify, KYC, Stocks, Crypto, News, Data

io.github.Its-fortunatefolly/hubvibe

Offers paid utilities for web audits, HTTP fetching and extraction, BigQuery analysis, LLM processing, code execution, blockchain…

developer-tools

net.programmes/developer-tools

Provides general-purpose developer utilities for encoding, hashing, encryption, JSON, HTML, CSS, networking, and related data tra…

Qiniso

io.github.qinisolabs/qiniso

Provides deterministic formatting, parsing, holiday and tax lookups, address handling, and checksum or structure validation for i…

ContrastAPI

com.contrastcyber/api

Provides security research and assessment tools covering CVEs, IOCs, dependencies, secrets, injection risks, HTTP headers, domain…